Section 404 of the Sarbanes-Oxley Act has two parts. Section 404(a) requires management of every issuer to assess and report on the effectiveness of internal control over financial reporting (ICFR) at year-end. Section 404(b) requires the company's auditor to attest to and report on management's assessment, for filers that are not exempt. For the overview of the Act and who is exempt, see the SOX compliance guide.
This guide covers the mechanics: what management's report contains, how a top-down assessment is run, what the auditor does under PCAOB Auditing Standard 2201, and how deficiencies are rated, with a worked example.
What is ICFR?
The SEC's rules define internal control over financial reporting as a process designed by, or under the supervision of, the company's principal executive and principal financial officers, carried out by the board, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. It includes policies and procedures covering records that fairly reflect transactions, authorization of receipts and expenditures, and prevention or timely detection of unauthorized acquisition, use or disposition of assets that could have a material effect on the financial statements.
ICFR is narrower than internal control as a whole. It does not cover operational or compliance controls unless they bear on the financial statements. See internal control over financial reporting.
What goes in management's report?
Management's annual report on ICFR includes:
- a statement of management's responsibility for establishing and maintaining adequate ICFR
- identification of the framework used to evaluate effectiveness, usually the COSO Internal Control—Integrated Framework (2013). See COSO framework
- management's assessment of effectiveness as of the end of the fiscal year, including disclosure of any material weakness. Management cannot conclude that ICFR is effective if there is one
- a statement that the registered public accounting firm has issued an attestation report, where required
Separately, management evaluates changes in ICFR each quarter and discloses material changes. Section 302 certifications cover these.
Running a top-down, risk-based assessment
The SEC's 2007 interpretive guidance (Release 33-8810) lets management scale the work to risk. A typical sequence:
- Identify risks of material misstatement to the financial statements from the financial statement line items and disclosures, considering both the possibility and the magnitude of misstatement, including fraud risk.
- Identify controls that address those risks, starting with entity-level controls (the control environment, anti-fraud programs, period-end reporting, management override) and then process-level controls.
- Evaluate design. Would the control, if performed as described, prevent or detect a material misstatement?
- Evaluate operation. Test enough instances. See control testing.
- Evaluate evidence by risk. Higher-risk areas need more persuasive evidence, such as testing by independent staff rather than self-assessment.
- Evaluate deficiencies individually and in combination.
- Conclude and report.
A management review control, such as a monthly flux review, needs evidence of precision: what threshold triggers investigation, what data the reviewer used, and whether the data was complete and accurate. See the management review control worksheet.
What does the auditor do under AS 2201?
PCAOB Auditing Standard 2201 requires an audit of ICFR that is integrated with the audit of the financial statements. The auditor expresses an opinion on ICFR effectiveness and an opinion on the financial statements, and the evidence gathered supports both. The main features:
- Top-down approach. The auditor starts at the financial statement level, evaluates entity-level controls, identifies significant accounts and disclosures and relevant assertions, understands the likely sources of misstatement and then selects controls to test that address them.
- Testing design and operating effectiveness. The auditor tests controls using inquiry combined with observation, inspection or reperformance. Inquiry alone is insufficient.
- Use of the work of others. The auditor may use the work of others, such as internal audit and management testing, depending on the competence and objectivity of those who did it and the risk associated with the control. The standard reserves judgment about the highest-risk areas to the auditor.
- Fraud and IT. The auditor considers fraud risk in selecting controls and the controls that address those risks, including journal entries and IT general controls.
- Evaluating deficiencies. The auditor evaluates the severity of identified deficiencies, including those found only during the financial statement audit.
- Reporting. If a material weakness exists, the auditor expresses an adverse opinion on ICFR. The auditor communicates in writing all material weaknesses to management and the audit committee.
Where there are indicators, such as fraud by senior management, a restatement to correct a material misstatement, auditor-identified misstatement that ICFR would not have caught, or ineffective audit committee oversight, a material weakness is likely. These parallel the indicators in AU-C 265 for nonissuer audits; see AU-C 265.
The nonissuer comparison is useful for firms that serve both types of client: AU-C 265 covers communication of deficiencies found in a financial statement audit, and does not require an opinion on internal control. The AICPA examination standard AT-C 205 is the route for a nonissuer that wants a report on ICFR.
How are deficiencies evaluated?
Three tiers apply under PCAOB and SEC definitions:
- Deficiency: the design or operation of a control does not allow management or employees to prevent or detect misstatements on a timely basis in the normal course of performing their functions.
- Significant deficiency: less severe than a material weakness but important enough to merit attention by those responsible for oversight of financial reporting.
- Material weakness: a deficiency, or combination, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.
Severity depends on two things: whether there is a reasonable possibility the controls will fail to prevent or detect a misstatement, and the magnitude of the potential misstatement. Severity does not depend on whether a misstatement actually occurred. Compensating controls are considered only if they operate at a level of precision that would prevent or detect a material misstatement.
Worked example: manual journal entry approval
Illustrative numbers. An issuer's control requires a controller to approve every manual journal entry before posting. The auditor tests 40 manual entries and finds 3 posted without approval. The deviation rate is 3 / 40 = 7.5%.
Evaluating severity
- Reasonable possibility of failure: a 7.5% deviation rate in a control expected to operate without exception, with no explanation tied to a one-off event, supports a reasonable possibility that the control fails.
- Magnitude of potential misstatement: the population of manual entries posted through the control during the year totals $14,000,000, against a materiality amount of $2,000,000. The potential misstatement could exceed materiality, since the control gates all of the entries. The relevant exposure is the amount of entries exposed to the deficiency, not the dollar value of the three exceptions.
- Fraud risk: journal entries are a management override risk, so a failure here has a higher severity profile.
- Compensating controls: suppose the CFO reviews a monthly report of all entries above $250,000. If testing shows that review operates with enough precision to catch an unapproved entry above a threshold below materiality, the exposure shrinks to entries below $250,000. Without that evidence, the compensating control does not count.
Conclusion. With no tested compensating control, the exposure is far above materiality and there is a reasonable possibility of failure, so the deficiency is evaluated as a material weakness. With a tested compensating control that limits exposure below materiality, it may be a significant deficiency. Management documents the analysis either way, and the auditor reaches its own conclusion. The deficiency evaluation worksheet follows this layout, and journal entry testing covers the underlying audit procedure.
Timing and first-year relief
A company's first annual report after its IPO need not include management's report or the auditor's attestation, under the SEC's transition rule for newly public companies. The second annual report must include management's report. The auditor attestation follows the filer's category.
Common mistakes
- Evaluating severity by what happened, not by what could have happened.
- Counting a compensating control without testing it.
- Testing a control at the wrong point in time, such as in the first quarter when the control changed in the fourth.
- Using reports from systems without testing completeness and accuracy.
- Leaving remediation to the last month, which leaves too few operations to retest.
Frequently asked questions
What is SOX 404?
The section of the Sarbanes-Oxley Act that requires management's annual assessment of ICFR and, for non-exempt filers, an auditor's attestation on it.
What is the difference between 404(a) and 404(b)?
404(a) is management's report on ICFR, required of all issuers. 404(b) is the auditor's attestation report, required of accelerated and large accelerated filers.
What framework do companies use?
Most use COSO's 2013 Internal Control—Integrated Framework. The SEC requires a suitable, recognized framework.
What does an adverse ICFR opinion mean?
The auditor concluded that one or more material weaknesses exist, so ICFR was not effective.
Does a material weakness mean the financial statements are wrong?
Not necessarily. It means there is a reasonable possibility a material misstatement would not have been prevented or detected on a timely basis. The financial statement audit opinion is separate.
Sources
- SEC, Release 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, sec.gov
- SEC, 17 CFR 240.13a-15 and 17 CFR 229.308
- PCAOB, AS 2201, pcaobus.org
- COSO, Internal Control—Integrated Framework (2013)
- AICPA, AU-C Section 265; AT-C Section 205
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error